That's because the "Cookie Law", which real name is the ePrivacy directive, is separate (and predates) from the GDPR. This directive defines in (24) [1] : So-c

That's because the "Cookie Law", which real name is the ePrivacy directive, is separate (and predates) from the GDPR. This directive defines in (24) [1] : So-called spyware, web bugs, hidden identifiers and other similar devices can enter the user's terminal without their knowledge in order to gain access to information, to store hidden information or to trace the activities of the user and may seriously intrude upon the privacy of these users. The definition is broad. Does server-side fingerprinting solutions fits into it? Maybe not in the letter of the law, but at least in the spirit. Until a court decide either way, we won't know for sure. [1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...